PT-2006-3490 · Unknown · Xtreme Topsites

Publicado 2006-05-23 · Atualizado 2011-03-08 · CVE-2006-2544

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xtreme Topsites version 1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the searchthis parameter in "lostid.php" and the id parameter in "stats.php", particularly when magic quotes gpc is disabled.

Recommendations For Xtreme Topsites version 1.1, consider disabling the searchthis parameter in "lostid.php" and the id parameter in "stats.php" until a fix is available. Additionally, enabling magic quotes gpc may help mitigate the risk of SQL injection attacks.

Correção

Identificadores relacionados

CVE-2006-2544

Produtos afetados

Xtreme Topsites

Referências · 4

• http://secunia.com/advisories/20192 · Aviso do Fabricante
• http://osvdb.org/25703 · Nota
• http://vupen.com/english/advisories/2006/1899 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2544 · Nota de Segurança